Description

The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension.

Remediation

References

CVE-2005-0453

Related Vulnerabilities

IBM WebSEAL Insufficiently Protected Credentials Vulnerability (CVE-2021-20439)

WordPress Plugin Consulting Elementor Widgets Local File Inclusion (1.3.0)

WordPress Plugin Catch Import Export Security Bypass (1.8)

Oracle Database Server Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-6477)

WordPress Plugin W3SCloud Contact Form 7 to Zoho CRM Cross-Site Scripting (1.1.2)

Severity

Medium

Classification

CVE-2005-0453

Tags

Missing Update Known Vulnerabilities